Executive brief
RansomLook is a web-based security monitoring application that provides administrators with a configuration interface. An authenticated user with low-level privileges can bypass authorization checks to modify critical application settings including notification systems, authentication configuration, and external service integrations. This could allow an attacker with a compromised standard user account to disable security features, redirect alerts, or cause service outages.
Technical details
The vulnerability is an authorization bypass in the /admin/config endpoint of RansomLook's web configuration editor. While the endpoint requires an authenticated session, it fails to perform explicit privilege or administrator authorization checks before granting access to configuration-management functionality. An authenticated low-privileged user can submit crafted configuration values that are written directly to config/generic.json, affecting notification, LDAP, SMTP, and general application settings. The configuration file contains sensitive values such as passwords, tokens, and API keys. The patch removes the /admin/config route entirely, preventing web-based configuration modification.
Affected products
- RansomLook
Timeline
- 2026-08-24: disclosed